Debugging (Tracing) WMI queries?

Question

I've got a third-party program that's making WMI queries to local WMI providers (so it's not using DCOM, so packet-sniffers are out). I'd like to find out what queries these are.

It's also on XP, so the new Vista WMI tracing infrastructure is out, as well, unfortunately.

Any pointers?

Answer 1

Have you tried setting the WMI logging level to Verbose using wmimgmt.msc? (More info on the MSDN Logging WMI Activity page)

You should then see the queries logged to the %windir%\system32\wbem\logs\wbemcore.log file.

-dave